Extracted

Extracted

• • Target

    f418f058b04604397e7e7ee35cc925fe24c150c7ebe395894644aef2377c96d9

  • Size

    685KB

  • MD5

    a5cf88acab030eb4e8f2df5317d0dc1d

  • SHA1

    d9c3db480350bea34c7538804cca1449abf193b7

  • SHA256

    f418f058b04604397e7e7ee35cc925fe24c150c7ebe395894644aef2377c96d9

  • SHA512

    9ef971e6e3fd8647d0c9333eab1483bde51eb6821a0c91c0c310f0a1e1db19add061281f55c663a9312f655d494b573f2fc822c98c012c55973c728c084867cd

  • SSDEEP

    12288:SMryy90AAJeB00t6ZykDzcUomnkVIErYNzTH/YOICkzBbNMExK44ztowhTo8KEd:0yQo1XkMlmbKYNzTgOIFRNMExKbBowhT

  Score

  10^/10

  redlinenicesonydiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1